19IAP service providers’ obligation to make individuals aware of personal information held

19 IAP service providers’ obligation to make individuals aware of personal information held

(1) An IAP service provider must prepare, and make publicly available, a document that sets out its policies on the management of information. (2) If an individual about whom an IAP service provider holds personal information so requests, the IAP service provider must, subject to subsection (4), take reasonable steps to inform him or her of: (a) the kinds of information it holds about him or her; and (b) the purpose for which the information is held; and (c) the way in which it collects, holds, uses and discloses the information; and (d) the persons and authorities to whom or to which the information may be disclosed; and (e) that he or she has the rights of reasonable access to, and of correction of, the information; and (f) how to exercise those rights. (3) Subject to subsection (4), an IAP service provider must, on request by an individual about whom the IAP service provider holds personal information, give him or her access to the information, and must do so without undue delay or cost. (4) However, nothing in subsection (2) or (3) requires an IAP service provider: (a) to inform an individual that a report under section 20 or 21 exists or has been made; or (b) to give an individual access to such a report.

Penalty: $10 000.